WordPress The Events Calendar plugin <= 6.1.2.2 - Broken Access Control vulnerability

CVE-2023-35777

Summary

The Events Calendar, a popular WordPress plugin developed by Modern Tribe, contains a missing authorization vulnerability that arises from incorrectly configured access control security levels. This flaw allows unauthorized access to certain functionalities, potentially exposing sensitive data and administrative controls to malicious actors. The issue affects all versions of the plugin starting from n/a to 6.1.2.2, emphasizing the need for immediate review and remediation of security configurations to protect users and their data.

References